Skip to content

Commit 12036fb

Browse files
drwetterdrwetter
committed
Update baseline scan + add/deprecate security headers
1 parent 8000885 commit 12036fb

File tree

2 files changed

+12
-4
lines changed

2 files changed

+12
-4
lines changed

‎t/baseline_data/default_testssl.csvfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@
7070
"FS_TLS13_sig_algs","testssl.sh/81.169.166.184","443","INFO","RSA-PSS-RSAE+SHA256 RSA-PSS-RSAE+SHA384 RSA-PSS-RSAE+SHA512","",""
7171
"HTTP_status_code","testssl.sh/81.169.166.184","443","INFO","200 OK ('/')","",""
7272
"HTTP_clock_skew","testssl.sh/81.169.166.184","443","INFO","0 seconds from localtime","",""
73-
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1654006271","",""
73+
"HTTP_headerTime","testssl.sh/81.169.166.184","443","INFO","1737570310","",""
7474
"HSTS_time","testssl.sh/81.169.166.184","443","OK","362 days (=31337000 seconds) > 15552000 seconds","",""
7575
"HSTS_subdomains","testssl.sh/81.169.166.184","443","INFO","only for this domain","",""
7676
"HSTS_preload","testssl.sh/81.169.166.184","443","INFO","domain is NOT marked for preloading","",""
@@ -81,6 +81,8 @@
8181
"X-Frame-Options","testssl.sh/81.169.166.184","443","OK","DENY","",""
8282
"X-Content-Type-Options","testssl.sh/81.169.166.184","443","OK","nosniff","",""
8383
"Content-Security-Policy","testssl.sh/81.169.166.184","443","OK","script-src 'unsafe-inline'; style-src 'unsafe-inline' 'self'; object-src 'self'; base-uri 'none'; form-action 'none'; img-src 'self' ; default-src 'self'; frame-ancestors 'self'; upgrade-insecure-requests;","",""
84+
"Cross-Origin-Opener-Policy","testssl.sh/81.169.166.184","443","INFO","same-origin-allow-popups","",""
85+
"Cross-Origin-Resource-Policy","testssl.sh/81.169.166.184","443","INFO","same-site","",""
8486
"banner_reverseproxy","testssl.sh/81.169.166.184","443","INFO","--","","CWE-200"
8587
"heartbleed","testssl.sh/81.169.166.184","443","OK","not vulnerable, no heartbeat extension","CVE-2014-0160","CWE-119"
8688
"CCS","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2014-0224","CWE-310"
@@ -95,7 +97,7 @@
9597
"SWEET32","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327"
9698
"FREAK","testssl.sh/81.169.166.184","443","OK","not vulnerable","CVE-2015-0204","CWE-310"
9799
"DROWN","testssl.sh/81.169.166.184","443","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310"
98-
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=31B44391529821C6A77F3C78B02D716A07F99B8FDB342BF5A78F263C25375968","CVE-2016-0800 CVE-2016-0703","CWE-310"
100+
"DROWN_hint","testssl.sh/81.169.166.184","443","INFO","Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see https://search.censys.io/search?resource=hosts&virtual_hosts=INCLUDE&q=5B4BC205947AED96ECB1879F2668F7F69D696C143BA8D1C69DBB4DC873C92AE9","CVE-2016-0800 CVE-2016-0703","CWE-310"
99101
"LOGJAM","testssl.sh/81.169.166.184","443","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310"
100102
"LOGJAM-common_primes","testssl.sh/81.169.166.184","443","OK","--","CVE-2015-4000","CWE-310"
101103
"BEAST_CBC_TLS1","testssl.sh/81.169.166.184","443","MEDIUM","ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA AES256-SHA","CVE-2011-3389","CWE-20"

‎testssl.sh‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3127,11 +3127,13 @@ emphasize_stuff_in_headers(){
31273127
-e "s/X-Powered-By/${yellow}X-Powered-By${off}/g" \
31283128
-e "s/X-UA-Compatible/${yellow}X-UA-Compatible${off}/g" \
31293129
-e "s/Link/${yellow}Link${off}/g" \
3130+
-e "s/X-DNS-Prefetch-Control/${html_yellow}X-DNS-Prefetch-Control${html_off}/g" \
31303131
-e "s/X-Rack-Cache/${yellow}X-Rack-Cache${off}/g" \
31313132
-e "s/X-Runtime/${yellow}X-Runtime${off}/g" \
31323133
-e "s/X-Pingback/${yellow}X-Pingback${off}/g" \
31333134
-e "s/X-Permitted-Cross-Domain-Policies/${yellow}X-Permitted-Cross-Domain-Policies${off}/g" \
31343135
-e "s/X-AspNet-Version/${yellow}X-AspNet-Version${off}/g" \
3136+
-e "s/X-AspNetMvc-Version/${yellow}X-AspNetMvc-Version${off}/g" \
31353137
-e "s/x-note/${yellow}x-note${off}/g" \
31363138
-e "s/x-global-transaction-id/${yellow}x-global-transaction-id${off}/g" \
31373139
-e "s/X-Global-Transaction-ID/${yellow}X-Global-Transaction-ID${off}/g" \
@@ -3177,9 +3179,11 @@ emphasize_stuff_in_headers(){
31773179
-e "s/Link/${html_yellow}Link${html_off}/g" \
31783180
-e "s/X-Runtime/${html_yellow}X-Runtime${html_off}/g" \
31793181
-e "s/X-Rack-Cache/${html_yellow}X-Rack-Cache${html_off}/g" \
3182+
-e "s/X-DNS-Prefetch-Control/${html_yellow}X-DNS-Prefetch-Control${html_off}/g" \
31803183
-e "s/X-Pingback/${html_yellow}X-Pingback${html_off}/g" \
31813184
-e "s/X-Permitted-Cross-Domain-Policies/${html_yellow}X-Permitted-Cross-Domain-Policies${html_off}/g" \
3182-
-e "s/X-AspNet-Version/${html_yellow}X-AspNet-Version${html_off}/g")" \
3185+
-e "s/X-AspNet-Version/${html_yellow}X-AspNet-Version${html_off}/g" \
3186+
-e "s/X-AspNetMvc-Version/${yellow}X-AspNetMvc-Version${off}/g" \
31833187
-e "s/x-note/${html_yellow}x-note${html_off}/g" \
31843188
-e "s/X-Global-Transaction-ID/${html_yellow}X-Global-Transaction-ID${html_off}/g" \
31853189
-e "s/x-global-transaction-id/${html_yellow}x-global-transaction-id${html_off}/g" \
@@ -3435,20 +3439,22 @@ run_security_headers() {
34353439

34363440
pr_bold " Security headers "
34373441
# X-XSS-Protection is useless and at worst harmful, see https://news.ycombinator.com/item?id=20472947
3442+
# Expect-CT is depecated, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT
34383443
for header_and_svrty in "X-Frame-Options OK" \
34393444
"X-Content-Type-Options OK" \
34403445
"Content-Security-Policy OK" \
34413446
"X-Content-Security-Policy INFO" \
34423447
"X-WebKit-CSP INFO" \
34433448
"Content-Security-Policy-Report-Only OK" \
3444-
"Expect-CT OK" \
3449+
"Expect-CT INFO" \
34453450
"Permissions-Policy OK" \
34463451
"Cross-Origin-Opener-Policy INFO" \
34473452
"Cross-Origin-Resource-Policy INFO" \
34483453
"Cross-Origin-Embedder-Policy INFO" \
34493454
"X-XSS-Protection INFO" \
34503455
"Access-Control-Allow-Origin INFO" \
34513456
"Access-Control-Allow-Credentials INFO" \
3457+
"Permissions-Policy INFO" \
34523458
"Upgrade INFO" \
34533459
"X-Served-By INFO" \
34543460
"Referrer-Policy INFO" \

0 commit comments

Comments
 (0)